CVE-2022-35982: TensorFlow vulnerable to segfault in SparseBincount

Background

TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service attack.

Vulnerability Detail

The vulnerability, identified as CVE-2022-35982, affects the SparseBincount function in TensorFlow. When provided with invalid inputs for indices, values, and dense_shape, the function can result in a segmentation fault (segfault). This can be exploited by an attacker to trigger a denial of service attack against a TensorFlow application. The vulnerability has a CVSS score of 5.9, indicating a moderate severity level.

pip install --upgrade "tensorflow==2.21.0"

Workaround

If immediate updating is not possible, users can implement a workaround by avoiding the usage of the SparseBincount function with invalid inputs. It is recommended to validate the inputs before passing them to the function to ensure they form a valid sparse tensor. Here is an example of how to validate the inputs:

import tensorflow as tf

def validate_sparse_inputs(indices, values, dense_shape):
    if not isinstance(indices, tf.Tensor) or not isinstance(values, tf.Tensor) or not isinstance(dense_shape, tf.Tensor):
        raise ValueError('Invalid inputs: indices, values, and dense_shape must be TensorFlow tensors.')
    if indices.dtype != tf.int64 or values.dtype != tf.int32 or dense_shape.dtype != tf.int64:
        raise ValueError('Invalid inputs: indices, values, and dense_shape must have the correct data types.')
    if indices.shape.rank != 1 or values.shape.rank != 1 or dense_shape.shape.rank != 1:
        raise ValueError('Invalid inputs: indices, values, and dense_shape must be 1-dimensional tensors.')

# Usage example
indices = ...
values = ...
dense_shape = ...
validate_sparse_inputs(indices, values, dense_shape)

Conclusion

In conclusion, TensorFlow is vulnerable to a segfault in the SparseBincount function, which can be exploited for a denial of service attack. Users are advised to update their TensorFlow installation to one of the patched versions and validate inputs to avoid the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ